What Is an ISO in Payments? Who Really Set Up Your Account

If you accept credit cards, there is a good chance the company that sold you your merchant account was not the processor whose name is on your statement. It was an ISO. Here is what that is, what it takes to become one, and why the answer to that second question should concern you.

What is an ISO in payments?

An ISO, or Independent Sales Organization, is a third party company registered by a bank to sell and service merchant accounts on that bank’s behalf. The ISO signs you up, quotes your rates, sets up your account, and usually handles your service calls. It does not hold your money. The acquiring bank does that.

Mastercard calls the same role an MSP, or Member Service Provider. The terms get used interchangeably, and a company registered with both networks is often written as ISO/MSP. In Visa’s own Third Party Agent Registration Program, an ISO is defined by its activity rather than its size: any entity that solicits merchant accounts, discusses pricing, fees or rates, drafts or manages contracts, or submits contracts to the acquirer.

Read that definition again with your own account in mind. The party that discusses your pricing is the ISO. Not the bank. Not the network. Not the processor whose logo sits at the top of your statement.

ISO vs payment processor vs acquirer vs payment facilitator

Four different companies can touch a single transaction, and merchants are rarely told which is which.

The acquiring bank

A member of the card networks. It holds the merchant agreement, takes the risk, and settles the money into your account. It is the only party in this list that touches your funds.

The processor

The technology and operations layer that authorizes, clears and settles the transaction and produces your monthly statement.

The ISO or MSP

The sales and service organization registered by the bank. It sets your pricing and structures your account, and it earns a residual on your processing every month for as long as you stay.

The payment facilitator

A different model entirely. A payfac signs a merchant acceptance agreement on the acquirer’s behalf and settles funds to merchants it sponsors underneath its own master account. If you were onboarded in ten minutes with no underwriting call, you are probably a sponsored merchant under a payfac rather than a merchant with your own account. The tradeoff is speed now, less to negotiate later, because there is no separate interchange line to work against.

What does it take to become an ISO?

Four questions worth asking about anyone who sets prices for a living: what does it cost, what education is required, what has to be proven, and what are they not allowed to do.

The cost: a check

Visa’s published figure for ISO registration and annual renewal is $5,000. Mastercard’s is not published, and the sources that quote it disagree with each other. Across both networks, most estimates land somewhere between $5,000 and $20,000 in the first year, plus legal fees and whatever the sponsoring bank requires. Money, in other words. Nothing but money.

The education: none

There is no exam. No license. No degree requirement. No continuing education. No governing body that certifies competence in interchange, in transaction qualification, or in anything else that determines what a merchant pays. Nobody, at any point in the process, is asked to demonstrate that they understand what they are about to sell.

The requirements: a bank willing to vouch for you

You cannot register yourself. Under Visa’s rules only a Visa client, meaning the bank, can register an agent, and that client is liable for the agents it registers. So the real gate is a sponsor: background and credit checks on the owners, financial statements, a business plan, and PCI validation where cardholder data is involved.

That vetting is real. It is also aimed in one direction. The bank is establishing whether you are a credit risk to the bank. At no point does it establish whether you know how to structure a merchant account correctly. Those are different questions, and only one of them gets asked.

The restrictions: disclosure and data, not price

A registered ISO must market in its registered name, must display its sponsor bank, cannot hold merchant funds, and must keep PCI validation current. Acquirers are barred from accepting applications from entities they have not registered, and the fine for using an unregistered agent starts at $10,000 per agent.

Now read that list for what is missing. There is no cap on markup. No required rate disclosure. No standard pricing format. No fiduciary duty to the merchant. Every rule in the book protects the networks, the banks and cardholder data. Not one of them governs what you are charged.

And the person across your desk may not be an ISO at all

Here is the part almost nobody explains. Visa’s rules allow sales representatives and referral entities to solicit merchants with no registration whatsoever, provided they do it in the registered ISO’s name.

So the $5,000 to $20,000 is not the entry price for selling you a merchant account. It is the entry price for running the organization the seller works under. For the person who actually sat down with you, quoted your rate and filled out your application, the entry price is zero.

Why this matters more than it sounds

Consider what the same country requires of the person who invests one dollar on your behalf. Exams. State registration. Federal registration. Continuing education. A duty of care that can be enforced against them. One dollar.

Now consider what is required of the person who structures how a billion dollars a year moves through your business. No exam. No license. No registration in their own name. No duty of care. Credit card processing is a non-regulated industry, and this is what that actually means in practice.

The usual defense is that investing carries risk and processing does not. That defense does not survive contact with the arithmetic. A dollar invested badly loses a dollar. An account structured badly loses a percentage of every transaction you will ever run, forever, and you will never see a statement that says so.

This is not a simple product being sold by unqualified people. It is one of the most complicated pricing systems in American commerce being sold by people with no requirement to understand it. Interchange alone runs to hundreds of categories, and the networks revise the rules and rates twice a year, every April and every October, with more than 200 changes in those two releases. Interchange makes up 80 to 90 percent of what card acceptance costs you.

Two different problems, and most merchants have both

There is a distinction here that matters, and missing it is why so many merchants believe they are fine when they are not.

Setup is how the account was built: interchange qualification, your merchant category code, gateway and terminal configuration, the data your transactions carry. That is decided at the moment the account is written, by whoever wrote it. In our audits, more than 90 percent of merchant accounts are not set up correctly, and the reason is upstream of any individual: no education, exam or proven expertise of any kind is required to do the setting up.

Overbilling is a separate matter. It is what gets added on top: markup, fees with official sounding names that no network ever charged, penalties applied to accounts that were never given a path to comply. A correctly structured account can still be overbilled, which is why fixing the setup does not settle the question of what you are being charged.

The two stack. That is how weAudit finds savings on roughly 99 percent of the audits it performs, and why the average client saves about 40 percent. If you want to see what the second problem looks like line by line, the statement decoder walks through the charges one at a time.

How to find out who is actually on your account

You can establish most of this yourself in about ten minutes.

• Look at the bottom of your merchant agreement. A registered ISO must name its sponsor bank. If you cannot find one, you may be dealing with an unregistered seller.
• Check whether the company that sold you the account is the same company named on your statement. It usually is not.
• Ask your rep directly whether they are a registered ISO or an agent working under someone else’s registration. The answer tells you who is accountable for the pricing.
• Ask how they are compensated on your account. A residual on your volume is an ongoing interest in what you pay.

None of this makes any particular ISO the villain. Plenty of them do honest work. The point is structural: nothing in the system requires the person pricing your account to know what they are doing, and nothing requires them to tell you what they are making. If you want to see how the same processor can produce a fully disclosed statement for one merchant and almost nothing for another, that is covered in how a merchant can have the lowest discount rate and the worst deal. And if you want to see how your processor scores against the rest of the market, the processor scoreboard rates them one by one.

Frequently asked questions

Is an ISO the same as a payment processor?

No. The processor runs the transaction and produces the statement. The ISO sells and services the account and sets the pricing. Many merchants deal only with the ISO and assume it is the processor.

Does an ISO hold my money?

No. Only the acquiring bank settles merchant funds. An ISO is a sales and service organization, not a financial institution.

How much does it cost to become a registered ISO?

Visa publishes $5,000 for registration and annual renewal. Mastercard does not publish its figure and the available sources disagree. Across both networks, most estimates fall between $5,000 and $20,000 in the first year, before legal costs and whatever the sponsoring bank requires.

What qualifications does an ISO need?

None in the sense most people mean. There is no exam, licence, degree or continuing education requirement. A sponsoring bank performs background, credit and financial checks, but those assess risk to the bank rather than competence toward the merchant.

Do all merchant services salespeople have to be registered?

No. Sales representatives and referral entities can solicit merchants without registering, as long as they do so in the registered ISO’s name. The registration requirement lands on the organization, not on the individual selling to you.

What is the difference between an ISO and a payment facilitator?

An ISO sells you your own merchant account with the acquiring bank. A payment facilitator sponsors you as a sub merchant underneath its own account and settles funds to you. Onboarding is faster with a payfac, and there is far less to renegotiate afterwards.

Related reading: what your processor can do with access to your bank account.

Sources for the registration rules and fees cited above: Visa’s Third Party Agent Registration Program materials, and published guidance from Global Payments, Akurateco, Kurv and eMerchant Authority, which differ from one another on the dollar figures.

(c) 2009-2026 weAudit.com. All rights reserved. This article is provided for general educational purposes and is not financial, legal, or accounting advice.